# The Gentlemen Ransomware — FortiOS CVE-2024-55591 Authentication Bypass + Custom G-BOT C2 Framework

> The Gentlemen ransomware group exploits FortiOS/FortiProxy authentication bypass CVE-2024-55591 (CVSS 9.6) for initial access, supplemented by brute-forced FortiGate SSL-VPN credentials. Post-exploitation pivots to a custom undocumented C2 framework (G-BOT) using per-beacon SOCKS5 tunneling in place of Cobalt Strike, and a Linux locker that encrypts Hyper-V guests at the hypervisor level to defeat in-VM endpoint agents.

- **Published:** 2026-06-05T00:00:00Z
- **Last reviewed:** 2026-06-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0685
- **ID:** TL-2026-0685
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591

## Description

The Gentlemen is a double-extortion ransomware operation tracked since mid-2025 that has industrialized FortiGate edge-device compromise as its primary intrusion vector. The group's flagship initial-access technique abuses CVE-2024-55591, an authentication bypass affecting the FortiOS and FortiProxy management interface. The flaw (CWE-288, Authentication Bypass Using an Alternate Path or Channel) lets an unauthenticated remote attacker craft requests to the Node.js websocket module of the administrative interface and obtain super-admin privileges. Once authenticated, operators create randomly named local administrator accounts, add SSL-VPN users, alter firewall policy, and harvest configuration to enumerate the internal estate.

Where CVE-2024-55591 is unavailable or patched, The Gentlemen falls back to large-scale credential brute-forcing of FortiGate SSL-VPN portals; reporting attributes roughly 1,000 brute-forced VPN accounts and an inventory of approximately 14,700 compromised FortiGate devices to the campaign's infrastructure. After gaining a foothold, the group deploys G-BOT, a bespoke command-and-control framework that replaces commodity tooling such as Cobalt Strike. Each G-BOT implant establishes a dedicated per-beacon SOCKS5 tunnel back to operator infrastructure, providing interactive proxied access into the victim network while minimizing the static signatures that mature EDR fleets fingerprint for Cobalt Strike beacons and named pipes.

The Gentlemen layer living-off-the-land and signed third-party tooling over the custom C2: PsExec and PDQ Deploy for lateral movement and mass execution, AnyDesk for persistent interactive access, and BYOVD-style driver abuse plus scripted termination of security agents for defense evasion. The group has publicly emphasized AI-assisted operations to accelerate reconnaissance, scripting, and victim triage. The destructive stage is delivered by two lockers: a Windows locker for endpoint and file-server encryption, and a Linux/ESXi-class locker purpose-built to run on Hyper-V hosts and encrypt guest virtual disks from the hypervisor layer, rendering in-guest endpoint protection blind to the encryption activity. Victims are pressured through a Tor-based data-leak site as part of standard double-extortion.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110 Brute Force
- T1136 Create Account
- T1219 Remote Access Tools
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1569 System Services
- T1021 Remote Services
- T1090 Proxy
- T1071 Application Layer Protocol
- T1046 Network Service Discovery
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1567 Exfiltration Over Web Service

## Sources

- [The Gentlemen Ransomware Group Uses Fortinet Exploits, AI, and Custom C2 Frameworks](https://cybersecuritynews.com/the-gentlemen-ransomware-group-uses-fortinet-exploits/)
- [Threat Assessment: The Gentlemen Ransomware Group](https://www.halcyon.ai/ransomware-research-reports/threat-assessment-the-gentlemen-ransomware-group)
- [CVE-2024-55591 (Tenable)](https://www.tenable.com/cve/CVE-2024-55591)
- [watchTowr Labs — FortiOS Auth Bypass PoC CVE-2024-55591](https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591)
- [Gentlemen Ransomware Exploits Fortinet Flaws, AI, and Custom C2 Tools](https://gbhackers.com/fortinet-flaws-ai-and-custom-c2-tools-exploited/)
- [Fortinet PSIRT Advisory FG-IR-24-535](https://fortiguard.fortinet.com/psirt/FG-IR-24-535)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0685